Skip to content
audiotale.net
Sign in
NewsNews

Binance $6.3B hack: 50 EIP-7702 authorizations, a fake job offer and what to check

Attackers drained Binance hot wallets on 29 October; Blockaid's on-chain analysis and Binance's preliminary report show how a delegation feature and a compromised engineer led to the largest crypto theft on record.

audiotale.net team

· 8 min read

Written by AI from the sources linked below. How we use AI

On this page
  1. Key points
  2. What to do
  3. What happened
  4. Background
  5. How it happened, according to Binance
  6. The numbers
  7. What it means
  8. What we don't know yet
  9. What to watch next
  10. Sources

On 29 October 2026, attackers moved about $6.3 billion out of Binance's hot wallets in roughly 20 minutes, the largest crypto theft on record. Binance has since published a preliminary incident report, and its account of how it started is not a cryptographic break at all: a fake job interview, a booby-trapped coding test, an internal AI tool used to hop between engineers' computers, and finally Binance's own wallet-signing service. For developers, the technical lesson is a single Ethereum feature, EIP-7702, that let one signature turn a hot wallet into attacker-controlled code.

Key points

  • Binance puts the impact of the 29 October attack at about $6.3 billion and says it will cover all losses with its SAFU fund and company money; Chainalysis counts about $6.4 billion.
  • On Ethereum, the attacker sent a single transaction with 50 EIP-7702 authorizations signed with the key of the wallet known as Binance 14, according to Blockaid. One matched the wallet's current nonce, and about three minutes later a sweep took roughly $2.5 billion.
  • Binance's preliminary report says the intrusion began with a fake job interview in September and a tampered Homebrew package in June, and says it found no evidence that a wallet private key leaked.
  • About $3 billion was frozen by Binance's estimate (Chainalysis: about $2.8 billion as of 3 November). Binance says it has replenished 98 percent of the affected tokens.
  • Chainalysis attributes the theft to North Korea's TraderTraitor group; ForkLog reports Binance said the FBI pointed to North Korea, and North Korea has denied it, per Wikipedia.

What to do

If you do not run an exchange or custody system, nothing in this incident requires action on your own wallet: Binance says user funds are safe. If you build or operate signing infrastructure, hot wallets or wallet software, the sources point to these steps (the first two follow Blockaid's write-up, the rest are our reading of Binance's report):

  1. Treat an EIP-7702 authorization as a privileged operation, subject to the same policy checks as a cold-wallet transfer, and pass the authorization list of every type-4 transaction to your screening layer.
  2. Monitor every hot-wallet address for a change from empty code to a delegation pointer, and keep a revocation transaction prepared in advance. The only way to clear a delegation is a new authorization from the same wallet pointing to the zero address; rotating keys does not clear it.
  3. Rehearse the emergency path. Per Binance's report as relayed by HackerNoon, pausing withdrawals did not stop the on-chain permission, and revoking it needed a special procedure because the MPC (multi-party computation) wallet has no single key to sign with.
  4. Developers who get unsolicited interview offers with a "coding test" should run that code only in a disposable virtual machine, never on a work laptop. Review what your internal AI assistants and automation tokens can reach.

What happened

Times below are UTC on 29 October. Binance's report, as summarised by ForkLog, says the first outflows were on the XRP Ledger between 20:05 and 20:09, when five hot wallets sent 233.46 million XRP to an attacker address. Transfers on Solana, Optimism, Bitcoin and other chains followed; ForkLog reports 18,270 BTC left a Bitcoin hot wallet.

The largest single move was on Ethereum. Blockaid, a blockchain security firm, reconstructed it from public data. At 20:20:59 an operator address sent a type-4 transaction to the wallet labelled Binance 14, carrying 50 EIP-7702 authorizations, one per nonce from 18,914,775 to 18,914,824, each delegating the wallet to a contract the attacker had deployed at 15:59. Because Binance 14 was still paying out withdrawals, the attacker could not know which nonce would be current, so it signed a window of values. Forty-nine were invalid and one matched.

At 20:24:23, 3 minutes 24 seconds later, the operator called a sweep function and moved 167,464 ETH, about 1.615 billion USDT and about 60 other tokens, worth about $2.5 billion at the time, to a fresh collection address. Binance 14 was left with 1 ETH. Within 12 minutes ten more Binance hot wallets across four chains sent funds to the same address, in what Blockaid describes as ordinary transfers signed by each wallet's own key. At 20:41 the operator used the still-delegated wallet to move 780 million USDC out of a Binance-owned smart account, and at 21:44 it swept another 200 million USDT that had arrived since. The last unauthorized transfer, 2,961.9 ETH, finalised at 23:56 per the HackerNoon summary of Binance's report.

Binance suspended deposits and withdrawals. Tether and Circle froze funds quickly: Chainalysis says freezes began by 5:14 p.m. ET (21:14 UTC), roughly 54 minutes after funds started moving. Binance signed a new authorization pointing the wallet at the zero address at 00:10 UTC on 30 October, which cleared the delegation, per HackerNoon's summary. Withdrawals reopened in phases from 1 November.

Background

Hot wallets are the online accounts an exchange uses to pay withdrawals. On Ethereum they are typically externally owned accounts (EOAs): an address controlled by a key, with no code. EIP-7702, activated with the Pectra upgrade in May 2025, lets an EOA run a smart contract's code after it signs an authorization naming that contract. For ordinary users this enables batching and gas sponsorship. For a hot wallet it means one valid signature over the right nonce gives an attacker persistent, code-level control, including over deposits that arrive later.

Blockaid says it verified four EIP-7702 incidents in the first half of 2026 totalling about $1.08 million, and had forecast a seven-figure case before year end. This one is roughly three orders of magnitude larger. Blockaid sells a product that screens transactions before signing, so treat its prevention claims as a vendor's view; its on-chain reconstruction is checkable by anyone against the public transactions.

The previous record was the February 2025 Bybit theft of roughly $1.5 billion, in which, per Cointelegraph's summary of Bybit's forensics, attackers compromised a Safe developer's credentials and deceived signers into approving a malicious transaction. Blockaid's CEO called the two incidents "very, very similar", and said the activity resembled operations linked to North Korea, while stressing that attribution was unconfirmed at the time.

How it happened, according to Binance

Binance published a preliminary incident report on 3 November. We could not open it directly (its site blocks automated requests), so the details below come from ForkLog's account of the report, corroborated in part by HackerNoon's summary. Treat them as Binance's account, not independently verified findings.

  • June: a Binance engineer tried to install a popular AI development tool and instead downloaded a modified Homebrew package. Security noticed the anomaly, replaced the device and updated credentials, but the attackers had already learned who worked on the wallet infrastructure.
  • September: another engineer was contacted on a legitimate job platform by someone posing as a project director, then went through two interview rounds, the second with a person claiming to lead a company that did not exist. The engineer was asked to download a test assignment, a repository with malicious code, to a work computer. Binance says the malware used obfuscation and evasion, and its components were not detected by the endpoint protection then in place.
  • 20 October: the attackers used that computer and an internal Binance AI tool to reach two more employees' devices, and found a token with permission to deploy containers.
  • 29 October: with stolen credentials they deployed a container and ran a script that let them interfere with transaction signing.

Binance says it detected and blocked 57 suspected state-sponsored attack attempts in 2026, and says it has rebuilt the affected wallet system, rebuilt the internal AI tool and its access controls, and replaced devices. It has not explained how the AI tool allowed movement between machines, according to HackerNoon.

The numbers

Figures differ by source. Binance says about $6.3 billion; Chainalysis says about $6.4 billion; TRM Labs, per noze, about $6.36 billion. The split by blockchain below is Wikipedia's tally and should be treated as approximate.

Assets taken in the 29 October attack by blockchainUS$ billion
Assets taken in the 29 October attack by blockchain (US$ billion)
US$ billion
Ethereum3.8
Bitcoin1.5
Tron0.628
XRP Ledger0.296
Solana0.096
Arbitrum, Optimism, Base0.039
Avalanche0.028
Polygon0.010

Source: Wikipedia, 2026 Binance hack (approximate, early tally)

Estimates of how much was frozen also differ, which is normal while tracing continues:

Estimated stolen funds frozen, by sourceUS$ billion
Estimated stolen funds frozen, by source (US$ billion)
US$ billion
Binance3.0
Chainalysis2.8
TRM Labs2.7

Source: Binance (about 3), Chainalysis as of 3 Nov, 11:30 a.m. ET (2.8), TRM Labs (2.7), as compiled by Wikipedia

Chainalysis adds that the attacker swapped $325 million of stablecoins for $285 million of ETH in nearly 20 minutes to stay ahead of freezes, and describes laundering patterns it had not seen before: thousands of automated transactions, many through addresses that first receive exactly 1 TRX.

What it means

For exchanges and custodians. The key was not the weak point; the process that decides what the key signs was. Blockaid's point, which Fireblocks reportedly shares per the noze analysis, is that rules which only look at transfers will miss a delegation. Policy has to cover EIP-7702 authorizations, wallet state changes and the workstations of the people who run the signing system.

For developers. The entry route was ordinary developer life: a package installer, a job-search message, a take-home test. Those are the same habits that make supply-chain attacks work everywhere, not just in crypto.

For companies adopting internal AI tools. If Binance's account is accurate, an internal assistant with broad reach became a way to move between machines. Audit what such tools can access.

For Binance. It says user funds are safe and has reopened withdrawals. Whether confidence returns depends on the independent review co-CEO Richard Teng has promised, per HackerNoon.

What we don't know yet

  • Binance's full technical post-mortem. The 3 November document is described as preliminary, and some controls are being kept private.
  • Exactly how the attackers obtained the signing authorizations for the other chains, and how the AI tool enabled lateral movement.
  • Attribution beyond the private-sector assessments. Chainalysis and TRM Labs attribute the theft to TraderTraitor; ForkLog reports Binance said the FBI pointed to North Korea; North Korea denies it, per Wikipedia. We cannot verify any of these ourselves.
  • A 6 November Bloomberg report, which we could not open, was summarised by Techmeme as saying the wallet permissions used cost about $15 to set up. We could not confirm that figure.
  • The final total, since Binance has said tracing continues, and how much of the non-freezable ETH, Bitcoin and other assets can be recovered.

What to watch next

Watch for Binance's full post-mortem and the independent expert review, law-enforcement statements on attribution, further freezes and recoveries by Chainalysis, TRM Labs and issuers, and whether wallet vendors and exchanges add EIP-7702-specific controls. Also watch for updates from Blockaid, whose live tracker of the stolen funds is linked from its report.

Sources

SaveStart the discussion

Written by

audiotale.net team

The official account of the people who run audiotale.net: announcements, conversation starters and the newsroom's drafts. Posts written with AI say so. Every other account here is a real person.

Read next